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THE CLAIMS DEFINING THE INVENTION ARE AS FOLLOWS:- 



1. 



A method of configurably profiling data comprising the steps of: 



receiving data from an input data stream; 

pre-processing the received data by performing configurable first calculations 
thereon to create data relating to profiling features; 

summarising the profiling features data over a length of time by performing 
configurable second calculations thereon to create summarised data relating to profiled 
features; and 

post processing the profiled features data by performing configurable third 
calculations thereon to create a profiled output data stream for further processing; 

2. A method according to claim 1 , wherein the pre-processing stage includes 
receiving feedback data, which is used in the first calculations to create the data relating 
to profiling features, wherein the post-processing stage creates the feedback data from 
the third calculations. 

3 . A method according to claim 1 , wherein the first calculations comprise applying 
a linear calculation to one or more sub-streams of the data. 

4. A method according to claim 3, wherein the linear calculation does not alter the 
data. 

5. A method according to claim 1, wherein intermediate results of the first 
calculations are temporarily stored for use in further first calculations. 



6. A method according to claim 1 , wherein each profiling feature is reconfigurably 
flagged as changed or unchanged to indicate whether or not the input data stream has 
changed from a previous input. 
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7. A method according to claim 1, wherein the behaviours of the profiling features 
data are summarised over a number of non-overlapping time slots of configurable 
length. 

8. A method according to claim 1 , wherein profiling features data independent of 
start and end times of events are stored in a scratch pad memory. 

9. A method according to claim 7, wherein the profiling feature data is stored in 
one of the slots that corresponds with when an event that caused the profile to be 
updated started or ended. 

1 0. A method according to claim 7, wherein the profiling feature data is stored in 
every slot during which the event was in progress. 

11. A method according to claim 7, wherein each new instance of data falling within 
a time slot overwrites data already in that time slot. 

1 2. A method according to claim 7, wherein the data in the time slots is 
accumulated. 

13. A method according to claim 7, wherein the time slots are configured to wrap, 
such that if an update to the profiling features goes beyond the end of the last (most 
recent) slot, it wraps around to the first (oldest) slot and overwrites the data and creates 
an event message. 

14. A method according to claim 1, wherein an event message is created when the 
profiler receives its first input. 

15. A method according to claim 1 4, wherein the second calculations include using 
event messages to trigger specified rules. 
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16. A method according to claim 1, wherein event messages form part of the data 
relating to profiled features for post-processing. 

17. A method according to claim 7, wherein the data relating to profiled features 
comprises information in the time slots and scratch page memory. 

18. A method according to claim 1 , wherein the third calculations include 
identifying potential indicators of the event sought. 

19. A method according to claim 1, wherein the third calculations include preparing 
the output data stream for further processing to identify indicators of the event sought. 

20. A method according to claim 1, wherein intermediate results of the third 
calculations are temporarily stored for use in further third calculations. 

21 . A method according to claim 1 , wherein each output data feature is 
reconfigurably flagged as changed or unchanged to indicate whether the profiled data 
stream has changed from a previous input or not. 

22. A method according to claim 1, wherein the data is profiled to detect possible 
instances of fraud. 

23. A method of fraud detection comprising the step of configurably profiling data 
according to claim 22. 

24. A configurable data profiling system comprising at least: 

a pre-processor arranged to receive an input data stream, the pre-processor also 
configured to perform configurable first calculations on the input data to create data 
relating to profiling features; 

a profiler configured to summarise the profiling features data over a length of 
time according to configurable second calculations to create summarised data relating to 
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profiled features; and 

a post-processor configured to perform configurable third calculations on the 
profiled features data to create profiled output data for further processing. 

25. A method according to claim 24, wherein the pre-processor is arranged to 
receive feedback data and perform the first calculations on the input and feedback to 
create the data relating to profiling features, wherein the post-processor is configured to 
perform configurable third calculations on the profiled features data to create the 
feedback data and the profiled output data, wherein the system further comprises a 
means for providing the feedback data to the pre-processor. 

26. A system according to claim 24, wherein the pre-processor is configured to apply 
a linear calculation to one or more sub-streams of the input and feedback data. 

27. A system according to claim 24, wherein the pre-processor comprises a 
temporary storage for storing intermediate results of the first calculations. 

28. A system according to claim 24, wherein the pre-processor comprises means for 
reconfigurably flagging to the profiler whether each profiling feature is as changed or 
unchanged. 

29. A system according to claim 24, wherein the profiler comprises a memory for 
storing profiling features data independent of start and end times of events. 

30. A system according to claim 28, wherein the profiler comprises a memory 
configured to store a plurality of non-overlapping time slots of configurable length. 

31. A system according to claim 28, wherein the plurality of non-overlapping time 
slots are configured to store the summarised behaviours of the profiling features data. 

32. A system according to claim 29, wherein the profiler is configured to store the 
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summarised behaviours of the profiling features data in one of the slots that corresponds 
with when an event that caused the profile to be updated started or ended. 

33. A system according to claim 29, wherein the profiler is configured to store the 
summarised behaviours of the profiling features data in every slot during which the 
event was in progress. 

34. A system according to claim 29, wherein the profiler is configured to store the 
summarised behaviours of the profiling features data in a time slot by overwriting data 
already in that time slot. 

35. A system according to claim 29, wherein the profiler is configured to store the 
summarised behaviours of the profiling features data in a time slot by accumulating a 
new instance of the data with data already in the time slot. 

36. A system according to claim 29, wherein the time slots are configured to wrap, 
such that if an update to the profiling features goes beyond the end of the last (most 
recent) slot, it wraps around to the first (oldest) slot and overwrites the data and creates 
an event message. 

37. A system according to claim 29, wherein the profiler is configured create an 
event message when the profiler receives its first input. 

38. A system according to claim 24, wherein the second calculations include using 
event messages to trigger specified rules, the event messages forming part of the data 
relating to profiled features for post-processing. 

39. A system according to claim 29, the profiler is configured to pass information in 
the start and end time independent memory and time slot memory to the post-processor 
as part of the profiled features data. 
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40. A system according to claim 24, wherein the post-processor is configured 
perform the third calculations by identifying potential indicators of the event sought. 

41 . A system according to claim 24, wherein the post-processor is configured 
perform the third calculations by preparing the output data stream for further processing 
to identify indicators of the event sought. 

42. A system according to claim 24, wherein the post-processor comprises a 
temporary storage for storing intermediate results of the third calculations. 

43. A system according to claim 24, wherein the post-processor comprises means for 
reconfigurably flagging in the output data stream whether each profiled feature is 
changed or unchanged. 

44. A fraud detection system comprising a configurable data profiling system 
according to claim 24. 



